5bc8e6f99911ef55bd375a08f2023d62c2a3a29d10aeb7938fb843d9074b691b

Analysis

max time kernel
111s
max time network
157s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
08/09/2024, 15:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d4aca9745b1df836541488f9ba87381e_JaffaCakes118.apk
Size 17.7MB
Sample240908-sw9alswbrc
SHA256 5bc8e6f99911ef55bd375a08f2023d62c2a3a29d10aeb7938fb843d9074b691b
MD5 d4aca9745b1df836541488f9ba87381e
SHA1 9d2430f0cba9aa83b00c4607e2bc2cd91c9a2158
SHA512 2b5b9864472c5c672b39b9c73c59e90c66bc06a97187ebd682deb830d9d8f21bcf440e1c3d1fe3ffe8202e796ecbb1f564ad7967055a1bbeaeb0ce0ad071e620
SSDEEP 393216:lRkM6oA9/wSg90/JJlGKI3QV8D3r13bxsrXIJoJl/AqaIv+EC3I0JAus0L+BQDQg:lt6/ng9OHlGKI3QV8jr1rxWYyboqHq3F
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery evasion execution impact persistence

Malware Config

Signatures

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	ir.ghazae.mahale.gelan.d

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	ir.ghazae.mahale.gelan.d

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ir.ghazae.mahale.gelan.d

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	ir.ghazae.mahale.gelan.d

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	ir.ghazae.mahale.gelan.d

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ir.ghazae.mahale.gelan.d

ir.ghazae.mahale.gelan.d
1⤵
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:5039

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

749fabb7-792e-45a5-990d-e4a345aa1048.jobs

Path /data/data/ir.ghazae.mahale.gelan.d/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/749fabb7-792e-45a5-990d-e4a345aa1048.jobs
Size 991B
SHA256 6b627171ec9e6c136e3fdf52f185993f054f46672221b872df5ab3699bc08e5a
MD5 136b24e7d531af138e718d306bdea435
SHA1 bc97ffbb44f0e52abe33eac7094418a722818c77
SHA512 35b0cb1b7482761e8e8ec2e2dc3ec1d203e29e80d6e55b9787ec991e11bcaefc313e739497db4421e071029987adb86a288395449d2a9edf122e3f405018074f
MD5 SHA1 SHA512

Submit Download

ac893696-5d32-4ad9-9e8c-cc91729d32e7.jobs

Path /data/data/ir.ghazae.mahale.gelan.d/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/ac893696-5d32-4ad9-9e8c-cc91729d32e7.jobs
Size 811B
SHA256 1a7c459f64562c2af5b6739159090dc1aba41bf19eacc8730eb77796974398cc
MD5 b1c236ff7d4843b08dd25ee7605428c4
SHA1 ec219656a4424b78c3651aaff0f4eb30c9739304
SHA512 680505288e3ffb86c0cdc898ee2132e41805cfc55782e60d27f8101653a143e7c1c61cd9340d90dceb710edec634fbc01d9d8277d096c1ffae1aa3dc6e96fe40
MD5 SHA1 SHA512

Submit Download

ade68770-56eb-41a7-8ffb-8c66a4565613.jobs

Path /data/data/ir.ghazae.mahale.gelan.d/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/ade68770-56eb-41a7-8ffb-8c66a4565613.jobs
Size 176B
SHA256 90949c83a3d90fc0128f0d5df662aef3699971ce9e63ab067382f970cbab8918
MD5 f56f328eea1d5c96a1b96dbbf59488df
SHA1 440c784cacff61932e2f61580b7cfdc3a4943c95
SHA512 36e370cf16dac8b173fa182960789974d4087a7b607042000118ce518db8f1eaf93cf4f3be42c1c26ab53e87ff54da33b4c57a3a15e5cd47f2c2b66efe8b3edb
MD5 SHA1 SHA512

Submit Download

c016ed27-c0de-4e80-8fd7-f24e3bd5f89c.jobs

Path /data/data/ir.ghazae.mahale.gelan.d/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/c016ed27-c0de-4e80-8fd7-f24e3bd5f89c.jobs
Size 278B
SHA256 e53e34e008a9945417682e69aa02f94be8ea87ef4c06298c5a4fcc04b72011f9
MD5 10a1139569e3e04b71881f248b8affc4
SHA1 2a60e30f39676f3a41cde9ae84f72be86ebfbb85
SHA512 c25b86c302726115a56ee31f7fb2162ed3b4ca0cc3814aacb59cb7fa383956f24fd1185fb20387b41c44b12aaa3af3ce97b335ef0e410eb9e5777d741872ee00
MD5 SHA1 SHA512

Submit Download

d2c5d63e-faff-4c72-b402-95ab0a5caf6f.jobs

Path /data/data/ir.ghazae.mahale.gelan.d/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/d2c5d63e-faff-4c72-b402-95ab0a5caf6f.jobs
Size 179B
SHA256 9537553772c29c4303e606e458fd9598c14f1eee3cadfb446e241638bee3ccdb
MD5 ac58f99a1b179d71e8621412ad31c6a1
SHA1 b51fdad95876f5615735c2ab411031ff67d5e946
SHA512 faf45d5eb4b890216e6ad33825ffc02cbc57914628e625164f9cbdacd5962ce8ca8f473ded2f56eb4d4006fc7cafa9cff8c9f76655f17f83f38d3e89b8d7e67b
MD5 SHA1 SHA512

Submit Download

__pushe_base_lib_db

Path /data/data/ir.ghazae.mahale.gelan.d/databases/__pushe_base_lib_db
Size 24KB
SHA256 829e6a5383ecc2b9fad64636b8361c0eb9f995bd218df144502bbd4946056f75
MD5 d9d3a377c3b6f62543327884f3cb46f9
SHA1 741bec73b4160db48f17995c0be34a783cf9d314
SHA512 63fb8de2044836c51218c6d98f64ab3335e5310b2ddb0f5e114a99e6d29ba6058340f1373ab9764fbbd709e0525db40b42782dda5b855815a9e09118a656e829
SSDEEP 24:TL66xSe7TlcK///IoVM9cREGSzGb7sfNlTaqt2asXA:T26xfHX9VM9USAoDaq8asXA
MD5 SHA1 SHA512 SSDEEP

Submit Download

__pushe_base_lib_db-journal

Path /data/data/ir.ghazae.mahale.gelan.d/databases/__pushe_base_lib_db-journal
Size 512B
SHA256 da3f42e089c728a399f42ceec7dcc0f4f5bf82e9e255bf1926c1a538e775b98f
MD5 d7178526a71289ac526933a486ff1167
SHA1 c77bcd160b4eb87a555bcebe4cba98bcfd063cbf
SHA512 3e103bcddc65669206c6d2c76e1b859eee86a4392fc18999809f524801666266e558de11e3ee4f4849eba2433cab4e8bd5131313a556a8237b0200eda4529888
MD5 SHA1 SHA512

Submit Download

__pushe_base_lib_db-journal

Path /data/data/ir.ghazae.mahale.gelan.d/databases/__pushe_base_lib_db-journal
Size 8KB
SHA256 c3c43dca57d113954e69f6bccc5048c9a5b84dee5f96e91ede50bb1899265031
MD5 5cc37e4a52dce4682017e0c1e839b8e1
SHA1 10a082f40a6b0773b17136de97bb891b4b224885
SHA512 6cf7af5d1dad42a345dd06d56c8bfdae1d3d58fbc778e647d787b6ce2ea818133053e26ba6ad649dd6550e23c59b835aca0e66c31671a8e95bd5d6b84d203984
SSDEEP 6:7+/l9BBn1Ag9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKB:7+t0qLiuWdwRmBEyPbO
MD5 SHA1 SHA512 SSDEEP

Submit Download

__pushe_base_lib_db-journal

Path /data/data/ir.ghazae.mahale.gelan.d/databases/__pushe_base_lib_db-journal
Size 8KB
SHA256 fd256f33a129dd76a781fc8d13cd621563e578fc90b02970bcace5fc1c808d28
MD5 7a06209f85da9a9ca7f0ff7659307931
SHA1 475ff4745be555556e2f1a574e3cc628255d7cf5
SHA512 74692ebf2f133515073df6a3683d2a7ed9d2e0b8117fe21d3256417db075d29da10173f414ad02ec6768acb1991bad1dad652ab8b8d1bc4b766e73c2b3b7acfe
SSDEEP 6:7+/l9a+gPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK4hM/S6:7+t4+4qLJdTRmBEyPb7hsJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

__pushe_base_lib_db-journal

Path /data/data/ir.ghazae.mahale.gelan.d/databases/__pushe_base_lib_db-journal
Size 8KB
SHA256 45734fc0621bba022ba45dc34c2964d51a28fce5b6472efa8bb90a35a04fb15e
MD5 1b19becc36e6241604752f4b72863adb
SHA1 68b631d0031ff8f6c793f1c41a02134ed7abd35a
SHA512 d1e5a70caca8ff729326dfc808fb03979b175b3334a206c62f4de0df5c0915f652894308869f06a2ce75257d214abb1ba154dfd217fb8b9d0f454f528e7f1106
SSDEEP 12:7+t4qLXyFormG4NK0COnHdOnHXy1TOnHyilc36/QN6/uJaEcZVMJwRPVz27VNgRa:7+t4qLbxSe7TlcK///IoVM9cREGS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

__pushe_base_lib_db-journal

Path /data/data/ir.ghazae.mahale.gelan.d/databases/__pushe_base_lib_db-journal
Size 8KB
SHA256 c5e6fbacf1043aa0972557c8fa2722aa1c77c031b0288e104fa3d34f4f5022cc
MD5 d3dcc444a383f76b0356fff81e57925e
SHA1 bae02263ee833b4b9a2586a3e3555e30163f7a5d
SHA512 67849c344078830c8e1de429192d1142b32d21e6a01a5aac0c861b4a90f810aeaded4e89e4767339b7a7bfb21bff4a1c69f304bd915e0df36429042db304ce28
SSDEEP 24:7+tUuZqt2asXrqLhFxSe7TlcK///IoVM9cREGSv:7MUuZq8asXrqFFxfHX9VM9USv
MD5 SHA1 SHA512 SSDEEP

Submit Download

__pushe_base_lib_db-journal

Path /data/data/ir.ghazae.mahale.gelan.d/databases/__pushe_base_lib_db-journal
Size 8KB
SHA256 f22922ae946861bba5a4a288b8e0dfaaf889de05a3d5608b01f59e222cb0d552
MD5 902625aaedfda157a22e4ac111e98d1e
SHA1 47e5b7a156c2f132bfe41fba0b1d653430b8b938
SHA512 bc7e77b8ae870ae1e4831c6c73286854bc3e25c30ab21d4ca9c7bdb5aef92e13453633fede70d84697cfb56995096cfa5eaef257358ed40b5ba221ac7490ba4f
SSDEEP 48:7MRfZopQ4+344TQmwONh4+IqfHxfHX9VM9USy:78Boa9I8Xh9I0HXbk1y
MD5 SHA1 SHA512 SSDEEP

Submit Download

cheshdb

Path /data/data/ir.ghazae.mahale.gelan.d/databases/cheshdb
Size 20KB
SHA256 7a4cc1011ce6e71bb6fb62340ee832349ccba912d948729b674a2bf09ce6b551
MD5 9106c7207cbca8814eb347530f559312
SHA1 e775ee96aeada25ea228e17e00eb7689cefe77d1
SHA512 ffd44b5743ee4ffce76a1b8b17dde8c35248ed7404a7560f49c2419922cc2f1e259ce3b43d0d64b4079bd26860eeb7ed1348a847b3aa9c47dee19ef0c3ab1e0d
SSDEEP 12:TLWHUO5aaocVkzONTSFbyG7uYy8oRmBEyPbP/Mapn:TL2vZVbN38GSP/Jn
MD5 SHA1 SHA512 SSDEEP

Submit Download

cheshdb

Path /data/data/ir.ghazae.mahale.gelan.d/databases/cheshdb
Size 20KB
SHA256 30f6ffe3680c77a44b5820fd837c1f4aa1741125f96a66742ab60055cc24a924
MD5 90c074e7c120225736ef713a5f86ffaf
SHA1 0f3c4ad33307da829d448bcc9a2f3517f2a98071
SHA512 6fafb600420693b286e72479c714c7fee7ebbc4b67c33d28a94da4d0e8e581211812d3af428b207d2293888969b2551ad1a4fedff25ad2476022052f4f7ca28b
SSDEEP 12:TL1O5aaocVkzONTSFbyG7uYy8oRmBEyPbP//aVy:TLOZVbN38GSP/Ky
MD5 SHA1 SHA512 SSDEEP

Submit Download

cheshdb

Path /data/data/ir.ghazae.mahale.gelan.d/databases/cheshdb
Size 24KB
SHA256 4f4987ac3d84abad3490459fa7a32b7bfadaae5f329e15dcff36e07d34faaeb1
MD5 259a1e4e7ebc4b0d0341ffcf0c3bc2ea
SHA1 9b8da5a0b24833a3e84567d9d8ee0d2f54d7b48c
SHA512 dc1296e2b0b18dd83a3782acb700e155ea9a60ef193bfa8c98999e7cc3c5b73a97c20a974cc956ab438aeeba812ec2d2f401fb2e714bb9bb5fb421fa4b7a2313
SSDEEP 12:TLLZO5aaocVkzONTSFbyG7uYy8oRmBEyPbD3OwGQ:TLLaZVbN38GSzGQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cheshdb-journal

Path /data/data/ir.ghazae.mahale.gelan.d/databases/cheshdb-journal
Size 512B
SHA256 11e3056659d6d115daf45392a50d44f5318f10977825ff6c0df5172ba7ecb006
MD5 e9e27e4419af47e77300310a1647427d
SHA1 efd71098ae97d4f209754361a0d65bbd30e99f10
SHA512 3ad09698b63fb25967c0a6e95818a2de5c6a068062523acef8302af366dee0f99291bc0764a589a7ba6a4c27c212ebce8c1d5f5f92826060321bf84faecd2db1
MD5 SHA1 SHA512

Submit Download

cheshdb-journal

Path /data/data/ir.ghazae.mahale.gelan.d/databases/cheshdb-journal
Size 8KB
SHA256 37fc743f4dd90b02af6249a9a38c0539818d698a27903306aba0850b0e5bedca
MD5 d1460eb153a903b1677ff25fefeb6f70
SHA1 04490d21a355b4adc558839383740ce20a77dc01
SHA512 b4ddada96916ce7e5fa577df18a55d854a5fd9ec54f4817de964e1c242616f31a47b27e10f307704d5e60260d42842a04bb85cb412ee0d0aae76f7ff88a25ec5
SSDEEP 6:7+/l9/mHn1HkWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKw:7+ttWqLiuWdwRmBEyPbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

cheshdb-journal

Path /data/data/ir.ghazae.mahale.gelan.d/databases/cheshdb-journal
Size 8KB
SHA256 09376117d56c33760ab046f3b00bf417eaa64a49598f1d9f9e3f2d5eca7393e7
MD5 62883f7dc58a5c927666061cfecf53da
SHA1 59342ffbe1d6274419b19ccf05a250a8f5fd3176
SHA512 7824bb6feef781112987e3e4e21045b6b8b76e4cc3e4123e5f388d497cb98180840557bb8b8bc901799a120f1dee6d86975dfd1089679bd399968045e89af330
SSDEEP 6:7+/l9/KPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKEM/b:7+tF+qLJdTRmBEyPbgb
MD5 SHA1 SHA512 SSDEEP

Submit Download

cheshdb-journal

Path /data/data/ir.ghazae.mahale.gelan.d/databases/cheshdb-journal
Size 8KB
SHA256 e5ce46d98a2ddcfc7e6daa7d222b83c4cf0b9fe587423460543ca9ca5b0939ed
MD5 98676b3b09944e695d5c32e4c5372394
SHA1 83588daf789871d96d6d4ad92ec564bc57fdba77
SHA512 80a12119f732007f86bcdb2a0a2db9eff4a53a6c8ac4718a3b8b843a039684f86a8695be77fb072e3f8a02df3ed2cde96ce3f68a031ba8ff5bd93b47e58f7473
SSDEEP 12:7+t2zqLlO5aaocVkzONTSFbyG7uYy8oRmBEyPbT:7+t2zqL+ZVbN38GST
MD5 SHA1 SHA512 SSDEEP

Submit Download

cheshdb-journal

Path /data/data/ir.ghazae.mahale.gelan.d/databases/cheshdb-journal
Size 12KB
SHA256 9cddcfd87ce68c93718d1355cc79a64dcc93e1477e42f71a73c323dec42ca4a4
MD5 cfc6b49837c00925cd24bd6e295c040f
SHA1 7bdc5edf00e86dd7ed47f23f1de6bb8bba92460f
SHA512 fdb9e458da5b04940fbed46f7d8465474b6fa58a4182ba97028cd63f053f5e19cf4a13338b40a0b2f69d9b580ce3040a5d6bbe736a36d4e971198b4f554e189f
SSDEEP 12:7+tR1i1pqLLZO5aaocVkzONTSFbyG7uYy8oRmBEyPbV:7+tREvqLLaZVbN38GSV
MD5 SHA1 SHA512 SSDEEP

Submit Download

cheshdb-journal

Path /data/data/ir.ghazae.mahale.gelan.d/databases/cheshdb-journal
Size 12KB
SHA256 09bd2865a024cd93d24eab960cf2ed3eba457a59d26ebe7e7b75621378be8046
MD5 f61e5caf264f02bfd4280978423171cf
SHA1 9e4f273864db85c64a12bca927a87ca31c2f1f80
SHA512 a975225df7ba0b8457868c0721d1bfd9a6b46527715480a93857b63eb41830cbab2f18e709c84350945b0cf40306a2bb55348d30db1daf27339572e3f4db11a1
SSDEEP 12:7+tvDOa3IvqLWHUO5aaocVkzONTSFbyG7uYy8oRmBEyPbz:7+tFQqL2vZVbN38GSz
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_default_job_manager

Path /data/data/ir.ghazae.mahale.gelan.d/databases/db_default_job_manager
Size 28KB
SHA256 cf82b6758bdd872525eac2c0060886978fe8560b170a4139dd782dec03c439c1
MD5 52f3999ab329a3b4b8f6033fa80f3609
SHA1 70de17b7beae1f338770620e9b7cc232f4bab4e5
SHA512 2defb8035efc52ace0903a8d00ce8f70e0e54a33cbcb9f5bd855718e721b3415ec1f6cf2e639d2b943f5451428ca70be14f8a6e8cc08ce8a46a7464bb950ab86
SSDEEP 24:TLjA6zEyC7xKIK5whKOELcGFM9ikxzGSiCBl:ThzdCw5UfoSrj
MD5 SHA1 SHA512 SSDEEP

Submit Download